mirror of
https://codeberg.org/guix/guix.git
synced 2026-09-05 21:31:37 +00:00
Reepca Russelstein
3e5c3217f3
The prior implementation of 'parse' was, to put it mildly, very accepting of
invalid input. This made it very difficult to review its security properties,
which ended up relying entirely on the fact that it still didn't allow "/" in
directory entry names and that O_CREAT|O_EXCL implicitly causes symlinks to
not be followed in the final component, and mkdir and symlink never follow
symlinks in the final component, and all of the above throw exceptions when
they fail.
Some examples of what was allowed prior:
1. Empty archives:
"nix-archive-1" "(" ")"
2. Archives with only a type:
"nix-archive-1" "(" "type" "regular" ")"
3. Archives of regular files with multiple contents, which would be
concatenated (e.g. this has contents "foobar"):
"nix-archive-1" "(" "type" "regular" "contents" "foo" "contents" "bar" ")"
4. Archives of directories with multiple entries with the same name, and that
aren't sorted:
"nix-archive-1" "(" "type" "directory"
"entry" "(" "name" "c" "node" "(" ")" ")"
"entry" "(" "name" "b" "node" "(" ")" ")"
"entry" "(" "name" "b" "node" "(" ")" ")"
"entry" "(" "name" "a" "node" "(" ")" ")" ")"
5. Archives of directories with empty entries:
"nix-archive-1" "(" "type" "directory" "entry" "(" ")" ")"
6. Archives of directories with entries with no name:
"nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")" ")" ")"
7. Archives of directories with entries with no node:
"nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a" ")" ")"
7. Archives of directories with entries with multiple names:
"nix-archive-1" "(" "type" "directory" "entry" "(" "name" "a"
"node" "(" ")"
"name" "b" ")" ")"
8. Archives of directories with entries with multiple nodes:
"nix-archive-1" "(" "type" "directory" "entry" "(" "node" "(" ")"
"node" "(" ")" ")" ")"
9. Archives of directories with entries with multiple names and multiple
nodes:
"nix-archive-1" "(" "type" "directory"
"entry" "(" "name" "a" "node" "(" ")"
"name" "b" "node" "(" ")" ")" ")"
Such permissiveness rather defeats the "normalized" part of "Normalized
ARchive".
Additionally, 'parse' previously used recursion with no explicit depth limit.
In practice Linux would still limit the depth to around 2048, since filenames
longer than 4096 bytes yield ENAMETOOLONG, but no such restriction exists on
Hurd.
The permissiveness issue is resolved by rewriting 'parse', and the unbounded
recursion issue is resolved by adding a nestLimit parameter so that no more
than DIRECTORY_NESTING_LIMIT (currently 256) levels of recursion are used. An
alternate implementation that doesn't use recursion, 'parse_unbounded', is
included in case it is determined that the nesting limit should be removed,
but currently only 'parse' is used.
* nix/libutil/archive.cc (parse): rewrite to add nestLimit parameter.
(parseDump): pass DIRECTORY_NESTING_LIMIT as nestLimit argument to 'parse'.
(parse_unbounded): new function.
Change-Id: Ia3c32cc645b609f6ae7f3bcafc491ec0073cbb51
Signed-off-by: Ludovic Courtès <ludo@gnu.org>